100-150 Multiple Select — 20 Questions

Question 1

A small office wants to reduce the risk of malware arriving through email and malicious websites while keeping administration simple. Which two measures provide the strongest protection against these threats? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install and regularly update endpoint antivirus and anti-malware software on all workstations.. The strongest pairing couples host-level defense with network-level filtering. Endpoint antivirus catches payloads that reach the workstation, while a secure web gateway or DNS filtering service blocks the malicious domains that deliver those payloads. Together they cover both the email and web vectors named in the scenario without heavy administrative overhead, whereas disabling updates, permitting all outbound traffic, and sharing administrator accounts all increase exposure.

Answer

Share a single administrator account among all staff so everyone can fix problems quickly.

Answer

Disable automatic operating system updates to prevent unexpected reboots.

Answer

Allow all outbound traffic from the internal network to simplify troubleshooting.

Question 2

Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?

Accepted Answer

Restricting unauthorized network access. ACLs are essential tools for traffic filtering and network segmentation. By controlling which packets are permitted or denied based on source, destination, and protocol, administrators enforce security policies at the network edge or between VLANs. Understanding how ACLs manage traffic flow is critical for maintaining network integrity and preventing unauthorized data access, as they provide the fundamental mechanism for restricting communication between sensitive network segments in a controlled and highly audit-able manner.

Answer

Encrypting sensitive data traffic

Answer

Automatically updating firmware

Answer

Providing hardware redundancy

Question 3

A network designer is planning to use the 10.50.0.0/16 address space. Which TWO of the following represent valid network IDs for subnets created by further dividing this space into /24 segments?

Accepted Answer

10.50.1.0. Options A (10.50.1.0) and B (10.50.255.0) are correct because when 10.50.0.0/16 is divided into /24 subnets, the third octet becomes the subnet identifier and the fourth octet must be 0, giving valid network IDs such as 10.50.0.0, 10.50.1.0, and 10.50.255.0, all of which fall within the 10.50.0.0–10.50.255.0 range. Option C (10.51.0.0) is outside the 10.50.0.0/16 block, since 10.51.x.x belongs to a different /16. Option D (10.50.0.255) is a host address within 10.50.0.0/24, not a network ID, because the host portion is non-zero. Option E (10.50.1.1) is also a host address in the 10.50.1.0/24 subnet, not a valid network ID.

Answer

10.51.0.0

Answer

10.50.0.255

Answer

10.50.1.1

Question 4

Which TWO methods are considered effective for securing the control plane of Cisco networking devices? (Choose two.)

Accepted Answer

Implementation of Control Plane Policing (CoPP). Securing the control plane is essential to protect the CPU from resource exhaustion and unauthorized access. By limiting access to management interfaces and protecting the CPU from excessive traffic, administrators ensure the stability of the device routing and switching functions. These practices are critical because the control plane is the 'brain' of the network device; if it is compromised or overwhelmed, the entire network segment may experience service outages.

Answer

Enabling SNMPv1 for remote monitoring

Answer

Disabling the use of SSH for remote management

Answer

Increasing the size of the routing table

Question 5

A network engineer is deploying a new Cisco switch and needs to configure it for remote management. The engineer wants to ensure that management traffic is isolated from user data traffic and that only authorized personnel can access the switch. Which two configuration steps should the engineer perform? (Choose two.)

Accepted Answer

Enable SSH and disable Telnet for remote access.. To enable secure remote management, the switch needs an IP address on a management VLAN interface, and remote access should use SSH while Telnet is disabled. These steps provide a reachable management address and ensure that management sessions are encrypted. Other options, like port security or DHCP snooping, address different security concerns and do not fulfill the specific requirements.

Answer

Configure port security on all access ports.

Answer

Configure a default gateway on the switch.

Answer

Enable DHCP snooping on the management VLAN.

Question 6

A network team is hardening a Cisco Catalyst switch that will be deployed at the edge of the corporate network. They want to reduce the risk of Layer 2 attacks such as MAC flooding and unauthorized device attachment. Which two actions should they take? (Choose two.)

Accepted Answer

Enable port security on access ports to limit the number of MAC addresses.. MAC flooding is countered by limiting learned MAC addresses per port, which port security accomplishes. Unauthorized physical attachment is reduced by disabling unused ports and parking them in an unused VLAN. Together these measures harden the access edge. The other options either misplace a feature, depend on missing prerequisites, or actively weaken trunk security, so they do not serve the team's stated objectives.

Answer

Enable Dynamic ARP Inspection on all access ports without DHCP snooping.

Answer

Configure the native VLAN on all trunk ports to match VLAN 1.

Answer

Enable IP source guard on routed uplinks only.

Question 7

A user reports they cannot access a web server at 192.168.50.10. Which TWO commands would provide the most useful initial diagnostic information regarding the path and reachability to this destination from a Windows workstation? (Choose two).

Accepted Answer

ping 192.168.50.10. Ping and Traceroute are the primary tools used to diagnose reachability and path issues across an IP network. Ping tests basic end-to-end connectivity using ICMP Echo Requests, while Traceroute identifies each hop along the path, helping to pinpoint exactly where a packet is being dropped. Mastering these utilities allows technicians to isolate faults between local, ISP, or remote segments.

Answer

ipconfig /renew

Answer

netstat -a

Answer

nslookup 192.168.50.10

Question 8

A network administrator is evaluating endpoint media types for a new VoIP deployment. The IP phones will be powered by the access switches and must negotiate power requirements automatically. Which TWO statements correctly describe how Power over Ethernet (PoE) negotiation works between a Power Sourcing Equipment (PSE) switch and a Powered Device (PD) phone? (Choose two.)

Accepted Answer

The PSE applies a low voltage to detect a valid PD signature resistance before supplying full power.. PoE negotiation begins with a physical-layer detection phase where the PSE checks for a valid PD signature resistance, then proceeds to classification. Later standards add LLDP-MED for dynamic power negotiation, allowing the phone and switch to agree on precise power levels. DHCP and manual static budgeting are not part of the PoE power negotiation process, and Gigabit Ethernet supports PoE without limitation.

Answer

The PSE supplies power on the same pairs used for data in 10BASE-T and 100BASE-TX, which is why Gigabit Ethernet cannot support PoE.

Answer

The PD must be manually configured with a static power budget on the switch port before it will receive any power.

Answer

The PD sends a DHCP request to the PSE to request a specific power class before link negotiation.

Question 9

A network designer is choosing between SFP and SFP+ transceivers for a new switch deployment. Which TWO statements correctly describe the differences and compatibility between these media modules?

Accepted Answer

SFP modules typically support speeds up to 1 Gbps. Option A is correct because SFP (Small Form-factor Pluggable) transceivers are specified for Gigabit Ethernet and lower rates, typically up to 1 Gbps, making them the standard choice for 1000BASE-X/SX/LX/T connections. Option B is correct because SFP+ is the enhanced variant standardized for 10 Gbps Ethernet (10GBASE-SR/LR/ER and DAC), which is its primary design purpose. Option C is wrong because SFP+ in an SFP slot is not guaranteed; the slot must explicitly support 10 Gbps and often requires the same form factor with matching electrical characteristics, so it will not 'always' work. Option D is wrong because SFP modules support fiber connectors such as LC (and sometimes SC), plus copper variants like 1000BASE-T use RJ-45, so RJ-45 is not exclusive. Option E is wrong because SFP+ modules exist for both single-mode and multimode fiber (e.g., 10GBASE-SR for MMF, 10GBASE-LR for SMF), so single-mode-only is inaccurate.

Answer

An SFP+ module will always work in a standard SFP slot

Answer

SFP modules use RJ-45 connectors exclusively

Answer

SFP+ modules are only compatible with single-mode fiber

Question 10

Users on a floor of an office building report that file transfers to a server are slow and sometimes stall. The technician suspects a duplex mismatch on the switch port connecting the server. Which TWO symptoms or outputs would confirm a duplex mismatch on that link? (Choose two.)

Accepted Answer

The switch interface shows a high number of FCS and CRC errors on received frames.. A duplex mismatch produces collisions on the half-duplex side while the full-duplex side keeps transmitting, corrupting frames in flight. The two clearest confirmations are late collisions counted on the half-duplex interface and CRC or FCS errors counted on received frames. Both counters rise steadily under load, and throughput drops because corrupted frames must be retransmitted by upper-layer protocols.

Answer

The switch logs show the port entering the err-disabled state repeatedly.

Answer

The switch port shows the line protocol as down while the physical link remains up.

Answer

The server's NIC reports a negotiated speed of 1000 Mb/s and full duplex.

Question 11

Which TWO characteristics distinguish the User Datagram Protocol (UDP) from the Transmission Control Protocol (TCP)?

Accepted Answer

UDP provides connectionless communication without a handshake.. The choice between TCP and UDP is a fundamental architectural decision based on the needs of the application. TCP provides reliability and flow control at the cost of overhead, while UDP prioritizes speed and efficiency. Understanding these differences allows network professionals to troubleshoot performance issues and optimize traffic for different types of data, such as streaming or file transfers.

Answer

UDP uses sequence numbers to reassemble data in the correct order.

Answer

UDP operates at the Network Layer of the OSI model.

Answer

UDP includes a three-way handshake to ensure delivery.

Question 12

A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?

Accepted Answer

show interfaces. Identifying physical layer issues requires inspecting interface statistics and state changes. 'show interfaces' reveals error counters like CRC, giants, and runts which signify physical layer degradation. 'show logging' provides a chronological history of interface state changes, allowing the technician to correlate connectivity drops with physical link flaps. Together, these tools provide a comprehensive view of the physical health of the connection between the host and the switch infrastructure.

Answer

show ip route

Answer

show ip arp

Answer

show ip protocols

Question 13

A network administrator is documenting the IPv6 addressing scheme for a new campus. The administrator must identify which statements about IPv6 address structure and notation are accurate. (Choose two.)

Accepted Answer

Leading zeros within each 16-bit group of an IPv6 address can be omitted to shorten the notation.. IPv6 text representation permits two key shortcuts: suppressing leading zeros inside each hextet and replacing one contiguous run of zero hextets with a double colon. The double colon may appear only once to keep the address unambiguous. Dotted-decimal masks and removal of trailing zeros are not valid, since they would either mix IPv4 conventions or alter the numeric value of the address.

Answer

An IPv6 address can contain multiple double colon sequences as long as each replaces a different zero run.

Answer

The IPv6 prefix length is expressed in dotted-decimal notation following a space, such as 2001:db8::1 255.255.255.0.

Answer

Trailing zeros at the end of a hextet may be removed to shorten the address, so 2001:0db0::1 can be written as 2001:0db::1.

Question 14

A network technician is selecting devices to protect a corporate network from external threats. Which TWO devices provide active threat mitigation by inspecting and blocking malicious traffic? (Choose TWO).

Accepted Answer

Firewall. Network security requires a multi-layered approach to protect against diverse threats. Firewalls and Intrusion Prevention Systems (IPS) are two fundamental components that work together to secure the perimeter and internal segments. Understanding the distinct roles these technologies play helps technicians design robust networks that can both block bad traffic and detect anomalies.

Answer

Antivirus

Answer

Honeypot

Answer

Load Balancer

Question 15

Which TWO of the following statements regarding IPv6 address representation are accurate?

Accepted Answer

Leading zeros in a 16-bit field can be omitted.. Option B is correct because RFC 4291 allows leading zeros within any 16-bit hexadecimal field (hextet) to be dropped, so 0db8 can be written as db8. Option D is correct because the double-colon (::) is the compression notation that stands in for one or more consecutive 16-bit groups that are all zeros, and it may appear only once in an address. Option A is wrong because :: can be used only a single time per address; using it twice would make the number of omitted zero groups ambiguous. Option C is wrong because IPv6 addresses are commonly written in compressed form, not always as a full 32-character hexadecimal string. Option E is wrong because only leading zeros may be omitted; trailing zeros are significant and must be retained.

Answer

The double-colon (::) can be used multiple times in a single IPv6 address to shorten it.

Answer

An IPv6 address must always be written in full 32-character hexadecimal format.

Answer

Trailing zeros in a 16-bit field can be omitted.

Question 16

A technician is installing a new set of outdoor wireless access points. Which TWO factors are most likely to cause signal attenuation or interference for these endpoints?

Accepted Answer

Thick concrete walls and metal structures. Option A is correct because thick concrete walls and metal structures are dense physical obstructions that absorb, reflect, and scatter RF energy, causing significant signal attenuation, especially at higher frequencies like 5 GHz and 6 GHz. Option C is correct because 2.4 GHz cordless phones and microwave ovens operate in or near the 2.4 GHz ISM band and emit RF energy that overlaps with WLAN channels, producing co-channel and adjacent-channel interference. Option B is not a factor because Category 6a cabling is a wired Ethernet medium for the backhaul and does not radiate or attenuate wireless signals in a way that affects RF propagation. Option D is not a factor because PoE+ (802.3at) is simply a power-delivery standard over Ethernet and does not cause RF attenuation or interference. Option E is not a factor because an LC-to-LC fiber patch cord carries optical signals for wired backhaul and is immune to RF interference and does not affect wireless signal quality.

Answer

The use of Category 6a cabling for the backhaul

Answer

Configuring the access point for PoE+ (802.3at)

Answer

Using an LC-to-LC fiber patch cord

Question 17

A network technician is troubleshooting a PC that cannot access internal network resources. Which TWO steps are recommended to verify if the PC is receiving a valid IP address?

Accepted Answer

Run ipconfig on the workstation.. Verifying the IP configuration is essential when network access fails. Using 'ipconfig' allows the technician to see if the PC has a valid address, subnet mask, and gateway. Checking the DHCP server configuration ensures that the scope is not exhausted and that the client is actually communicating with the server. These two steps confirm if the layer 3 addressing is correct before moving on to more complex layer 2 or routing issues.

Answer

Check the switch interface status.

Answer

Perform a traceroute to the local gateway.

Answer

Reset the switch configuration.

Question 18

A network engineer is troubleshooting a potential DHCP issue. Which THREE components are provided to a client during a successful DHCP 'Acknowledgment' (ACK) message? (Choose three.)

Accepted Answer

IP address for the client.. The DHCP ACK is the final step in the DORA process where the server confirms the lease of an IP address. Understanding the specific parameters delivered in this message is crucial for diagnosing configuration errors that affect host connectivity, name resolution, and the ability of devices to reach resources outside their local network segment.

Answer

The MAC address of the DHCP server.

Answer

The SSH private key for the management console.

Question 19

A junior technician is organizing a box of fiber optic patch cords. Which TWO connector types are commonly used to terminate modern fiber optic media? (Choose TWO.)

Accepted Answer

LC (Lucent Connector). Identifying physical connectors is a fundamental skill for network support technicians working with fiber infrastructure. LC and SC connectors are the industry standards for most enterprise networking equipment. Knowledge of these connectors prevents damage to SFP modules and patch panels that may occur if a technician attempts to force an incompatible physical connection.

Answer

RJ-45

Answer

BNC

Answer

F-type

Question 20

Which TWO of the following statements regarding IPv4 address types are true?

Accepted Answer

Public IP addresses are globally routable across the internet.. Understanding the distinction between private, public, and special-use IPv4 addresses is critical for network security and traffic routing. Private addresses allow internal segmentation without internet visibility, while special addresses like the loopback range are essential for local service testing. Mastering these types prevents common errors like NAT misconfiguration or routing traffic into non-existent or internal-only address blocks across the network infrastructure.

Answer

Private IP addresses can be routed directly across the public internet.

Answer

The 127.0.0.0/8 range is used for private internal communication.

Answer

All IPv4 addresses are assigned automatically by the ISP.